Splunk Search

How to extract fields containing spaces within quotes in a space-delimited file?

chiphahn
New Member

I have a file that is space-delimited. It contains two fields that contain spaces. These fields are surrounded by quotes - "This would be a field". When going through the Data Extraction wizard using the delimiter method, renaming the fields, I find that these two fields are getting separated into multiple fields -- "This, would, be, a, field" using my example from before. Is there a way to tell Splunk to treat the contents inside quotes as a single field?

0 Karma

gneumann_splunk
Splunk Employee
Splunk Employee

Here is some information about fields and field extraction -- you can review the sections in the left panel: http://docs.splunk.com/Documentation/Splunk/6.6.2/Knowledge/Aboutfields
You can also review the Related Questions in the right panel of this Answers page. Not sure how to resolve your issue, but will contact someone that might be able to help.

0 Karma

gneumann_splunk
Splunk Employee
Splunk Employee
0 Karma

chiphahn
New Member

Thank you for replying - however I am not at this point doing a search. I am trying to extract fields. More specifically,

My sample selection of data contains the following data
2017-08-17 10.0.3.40 200 200 "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"

Most of the line (event) contains data separated by spaces, but as you can see, there is one field that also includes spaces, but is inside quotes. I need Splunk to see this as one field, which will be called "UserAgent" (which later could be part of a search criteria).

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...